Privacy policy

Who we are

Coral Garden Software Ltd, trading as Conduit ("we", "us" or "our"), is the controller of the personal data that the section "Our two roles" describes. Registered in England and Wales, company number 17029223. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. Contact: hello@conduit.solar.

We have not appointed a data protection officer. Send all privacy questions to hello@conduit.solar.

Our two roles

Conduit is software that solar installation businesses ("installers") use to manage their customers, quotes, projects and invoices. We have a different role for different data:

• We are the controller for the data about the people who use our website, the people who sign in to Conduit, the people who contact us, and the people who ask us for a solar estimate through our own lead service.
• We are a processor for the data that an installer keeps in Conduit about its customers, leads and staff. The installer is the controller of that data. We process it only on the instructions of the installer, as our terms of service describe. If you are a customer of an installer, the privacy notice of that installer applies to you. Send requests about that data to the installer. If you send them to us, we pass them to the installer.

The data that we collect

• Account data. Your name, email address, password (which we store only as a hash), role, organization, language and settings. Your employer or the administrator who invites you gives us some of this data.
• Use and security data. Your IP address, browser type, the pages that you open, the actions that you take, the time of each action, sign-in records and error records.
• Messages. The content of emails and WhatsApp messages that you send to us or to an address or number that Conduit operates, and the questions that you ask the Conduit assistant.
• Estimate requests. If you ask for a solar estimate, your name, email address, phone number, postcode, country and monthly electricity bill, the estimate that we calculate, and the methods of contact that you select.
• Consent and signature records. When you give consent or sign a document, the date and time, your IP address, your browser type, the page that you used and the exact text that you agreed to.
• Property details. If you complete a questionnaire, the details of your property, a location that you mark on a map, and the photos and documents that you upload, for example an electricity bill.
• Business contact data. If you contact us about Conduit, your name, email address, company and the content of your message.

When an installer uses Conduit to collect data from you, for example with a questionnaire, a signature request or a message, the installer is the controller of that data.

You do not have to give us personal data. But if you do not give the data that a form asks for, we cannot answer your request or give you an account.

Why we use your data, and our legal basis

• To supply Conduit to installers and their users. Legal basis: our legitimate interest, and the legitimate interest of the installer, to supply the software under our contract with the installer. If you are the installer and a sole trader, the legal basis is the contract with you.
• To answer your estimate request and contact you about it. Legal basis: your consent, separately for each method of contact that you select.
• To introduce you to an installer. Legal basis: your consent. The section "Introductions to installers" gives the details.
• To keep Conduit secure, find and stop misuse, and correct errors. Legal basis: our legitimate interest in a safe and reliable service.
• To improve Conduit. Legal basis: our legitimate interest. For this purpose, we use only statistics in an aggregated form that does not identify a person, and the error records in our use and security data.
• To answer questions from businesses about Conduit. Legal basis: our legitimate interest in answering the people who contact us.
• To obey the law, and to make, use or defend legal claims. Legal basis: a legal obligation, or our legitimate interest.

Where we use legitimate interest, we balance it against your rights. You can object at any time, as the section "Your rights" explains. We do not use your data for advertising, and we do not sell it.

How we contact you

When you ask for an estimate, you agree to this statement: "I agree that Conduit may contact me about my solar estimate using the methods I have selected above. When Conduit introduces me to a specific installer, my consent will be confirmed again at that point."

We use only the methods of contact that you select: phone call, text message (SMS) or email. You can withdraw your consent at any time. To do so, reply to a message from us or send an email to hello@conduit.solar. We then stop contact with you. A withdrawal does not change the lawfulness of the contact before it.

Introductions to installers

If you ask for an estimate on the website of an installer, your request goes directly to that installer. The installer is then the controller of your data.

If you ask for an estimate through our own lead service, we keep your details in Conduit until we find a suitable installer. We do not put your details on a shared list, and we do not sell them to installers.

• If you live in the UK, the European Union, Iceland, Liechtenstein or Norway, we send you a message that names the installer. We share your details only after you confirm.
• If you live in a different country, we share your details with 1 installer that we choose for your request, and we record the name of that installer. You can ask us at any time which installer got your details.

After the introduction, the installer is the controller of the details that it got, and its own privacy notice applies.

Who gets your data

We use these service providers to operate Conduit. They process personal data only on our instructions.

• Amazon Web Services, Inc.: hosting, databases, file storage, content delivery and email, in Singapore and the United States.
• PlanetScale, Inc.: database hosting, in the United States.
• OpenRouter, Inc.: access to AI models, in the United States. OpenRouter sends the data that an AI feature needs to the model that the feature uses. Today these are models from OpenAI and DeepSeek. OpenRouter can send a request to the developer of the model, or to a different company that hosts the same model, in the United States or in other countries.
• Mapbox, Inc.: the map in property questionnaires, in the United States.
• Meta Platforms, Inc. and Meta Platforms Ireland Limited (WhatsApp Business Platform): messages to and from the Conduit WhatsApp number, in the United States, the European Union and other countries.
• BunnyWay d.o.o. (Bunny Fonts): the fonts of our pages, in the European Union. Your browser sends your IP address when it gets the fonts.

We also share personal data when the law requires it, to protect the rights and safety of people, and with a buyer if we sell our business. In a sale, the buyer must use your data as this policy describes.

Transfers to other countries

We are in the UK, and we store data in Singapore and the United States. Our service providers can process data in other countries. When we transfer personal data from the UK, the EEA or Switzerland to a country that does not have an adequacy decision, we use the safeguards that the law requires, for example the standard contractual clauses of the European Commission and the international data transfer addendum of the UK. Send an email to hello@conduit.solar to get a copy of the safeguards.

How long we keep your data

• Account data: while the account is open. When the terms of service with an installer end, we delete its data within 90 days after the 30-day export period, unless the law requires us to keep it.
• Use and security data: as long as we need it to find and correct errors and to investigate security incidents.
• Sessions: a session ends after 120 minutes without activity.
• Estimate requests: while we work on your request. If you withdraw your consent or ask us to delete your details, we delete them. We keep only the minimum record that shows that you withdrew consent, so that we do not contact you again.
• Consent and signature records: as long as we keep the data that they apply to, and after that for as long as we need them to show that we obeyed the law or to defend a legal claim.
• Messages: a message to the Conduit WhatsApp number or to a Conduit email address stays in the account of the installer that it belongs to, under the rule for account data. A message from a business to us stays as long as we need it to answer you and to keep a record of our business relationship.
• Backups: deleted data stays in backups until the backups expire. We do not restore deleted data to normal use.

The installer decides how long to keep the data that it keeps in Conduit. For example, tax law can require an installer to keep invoices for 5 years or more.

Security

We use encrypted connections (HTTPS) for all pages, and encrypted connections to our databases. We limit access to data by organization and by role, and we keep records of important actions. No system is fully secure. If a breach of personal data occurs, we tell the people and the authorities that the law requires us to tell.

AI and automated decisions

Conduit uses AI models to read documents such as electricity bills, to sort messages, to answer questions and to draft records and replies. We do not let AI make a decision that has a legal effect or a similarly significant effect on you unless a person examines it. We do not use your data to train AI models.

Cookies

We use only the cookies that are necessary for Conduit to work:

• a session cookie, which keeps you signed in and keeps the forms in your browser connected to your session;
• a security cookie (XSRF-TOKEN), which stops other websites from sending forms in your name;
• a "remember me" cookie, only if you select "Remember me" when you sign in.

We do not use cookies for analytics or advertising. Because of this, we do not ask for consent to cookies. Your browser can store your choice of light or dark appearance in local storage. The map in property questionnaires (Mapbox) can also store a technical identifier in local storage. Mapbox uses it to count the use of the map.

Your rights

In most countries, you have the right to:

• know how we use your data, and get a copy of it;
• correct data that is wrong or incomplete;
• ask us to delete your data, or to stop or limit its use;
• object to our use of your data for a legitimate interest;
• get the data that you gave us in a format that a computer can read, and ask us to send it to another organization;
• withdraw your consent at any time.

To use a right, send an email to hello@conduit.solar. We can ask you to prove your identity. We answer within 1 month. If a request is complex, we can extend this period as the law permits, and we tell you why. We do not charge a fee unless the law permits it. We do not treat you differently because you use a right.

These rights also apply in specific regions:

• UK and EEA. You have the rights in the UK GDPR or the EU GDPR. You can complain to the Information Commissioner's Office (ico.org.uk) or to the data protection authority of the country where you live or work.
• United States. If you live in California or in a different state with a privacy law, you have the rights to know, to access, to correct and to delete your personal information, and to opt out of its sale, of sharing for targeted advertising, and of profiling. We do not sell personal information, and we do not share it for targeted advertising. An authorized agent can make a request for you. If we refuse a request, you can appeal by email to hello@conduit.solar.
• Philippines. You have the rights in the Data Privacy Act of 2012. These include the rights to object, to block your data and to get compensation for damages. You can complain to the National Privacy Commission (privacy.gov.ph).
• Other countries. You have the rights that your local law gives you. You can complain to your local data protection authority.

We ask you to contact us first, so that we can try to correct the problem.

Children

Conduit is for businesses and adults. Each user of an account must be at least 18 years old. We do not knowingly collect data from children under 16, for example through an estimate request. If you think that a child gave us personal data, tell us and we will delete it.

Changes to this policy

When we change this policy, we change the version at the top of this page. If a change is material, or adds or replaces a service provider that processes installer data, we tell account administrators by email or in Conduit at least 30 days before the change starts. We keep a record of the version that applied when you gave consent.

This policy is written in English. If a translation and the English text do not agree, the English text applies.

Contact

Send questions about this policy to hello@conduit.solar, or by post to Coral Garden Software Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. Our terms of service apply to the use of Conduit.